Extracted

• • Target
    da89bece99c8dd9f5e328c2ff8d2bbf06cf256a633a7c85d60ed978c5c51a262
  • Size 45KB
  • SHA256 da89bece99c8dd9f5e328c2ff8d2bbf06cf256a633a7c85d60ed978c5c51a262
  • MD5 971c610ccc41bd71b6387d6ee3d4b9d2
  • SHA1 6328d788461d61dda6d243edc554abf8c6cae49a
  • SHA512 ba8a7301df914cc249c47aa7908a3a25e99382965d73b2497dc633ef1812d2a1699c0621d271a69b0ad4a48cdad7ee407790f9b9c6eb125d65591feeb708d48d
  • SSDEEP 768:RuxkJTVmU5EkWUGMKSmo2q1HFpPklON8APIDzjbFgX3icpb1NbaR4ABDZcx:RuxkJTgip2O7kwN8lD3bCXScpL84Wdcx
  • TLSH
    T107231B0037E8812BF2BE4F78ADF26145867AF2636603D54A1CC452DB5723FC68A426FD
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2